Lavalair Sql Injection Blocker

[xcoderx]

Tht dnt stop hacking lol

[spiderwebs]

I Uses this when i used to use lavalair

ini_set("display_errors", "0");
if(!get_magic_quotes_gpc())
{
$_GET = array_map('trim', $_GET);
$_POST = array_map('trim', $_POST);
$_COOKIE = array_map('trim', $_COOKIE);

$_GET = array_map('addslashes', $_GET);
$_POST = array_map('addslashes', $_POST);
$_COOKIE = array_map('addslashes', $_COOKIE);
} 

[cedwap]

where to put that?

[riderz]

i think that comes in core.php

[Pablo]

yes it is in core.php

[newbie14]

re

ini_set("display_errors", "0");
if(!get_magic_quotes_gpc())
{
$_GET = array_map('trim', $_GET);
$_POST = array_map('trim', $_POST);
$_COOKIE = array_map('trim', $_COOKIE);

$_GET = array_map('addslashes', $_GET);
$_POST = array_map('addslashes', $_POST);
$_COOKIE = array_map('addslashes', $_COOKIE);
}

its true prevent sql inject?

[kiss]

function clean($str)
{
$str = @trim($str);
if(get_magic_quotes_gpc())
{
$str = stripslashes($str);
}
return mysql_real_escape_string($str);
} 

Easy and very usefull:
$test = clean($_REQUEST['test']);
$test = clean($_POST['test']);
$test = clean($_GET['test']);

[Ponick]

Post this in your core.Php

function check_injection()
  {
    $badchars = array("DROP", "SELECT", "UPDATE", "DELETE", "DELETE" , "UNION", "WHERE", "FROM");
  
    foreach($_REQUEST  as $value)
    {
      if(in_array(strtoupper($value), $badchars))
      {
      $logfile= 'log/log.txt'; //chmod 777
$IP = $_SERVER['REMOTE_ADDR'];
$logdetails= date("F j, Y, g:i a") . ': ' . '<a href=http://dnsstuff.com/tools/city.ch?ip='.$_SERVER['REMOTE_ADDR'].' target=_blank>'.$_SERVER['REMOTE_ADDR'].'</a>';
$fp = fopen($logfile, "r+");
fwrite($fp, $logdetails, strlen($logdetails));
fclose($fp);

       header('Location:http://go-to-hell.com');

      }
      else
      {
        $check = preg_split("//", $value, -1, PREG_SPLIT_OFFSET_CAPTURE);
        foreach($check as $char)
        {
         if(in_array(strtoupper($char), $badchars))
          {
      $logfile= 'log/log.txt';
$IP = $_SERVER['REMOTE_ADDR'];
$logdetails= date("F j, Y, g:i a") . ': ' . '<a href=http://dnsstuff.com/tools/city.ch?ip='.$_SERVER['REMOTE_ADDR'].' target=_blank>'.$_SERVER['REMOTE_ADDR'].'</a>';
$fp = fopen($logfile, "r+");
fwrite($fp, $logdetails, strlen($logdetails));
fclose($fp);

            header('Location:http://go-to-hell.com');
     }
    }
   }
  }
  } 

hehehe. . .

[kiLLeR-eyEd_14]

function safe($text)
{
$safe = stripslashes($text);
if(function_exists("mysql_real_escape_string"))
{
$safe = mysql_real_escape_string($safe);
}else if(function_exists("mysql_escape_string"))
{
$safe = mysql_escape_string($safe);
}
return $safe;
} 

use:
$str = safe($_POST['str']);
$str = safe($_GET['str']);

[kenxyz]

Where do i use d script

[murshid7]

how to stop sql blocking when some one comes and makes a external link to avatar, forum posts. how to stop that?

[Mysterio]

how to stop sql blocking when some one comes and makes a external link to avatar, forum posts. how to stop that?

try to make something like go.php, so when someone adds a link, it will loose everything in there, then redirect to the desired url.

[metulj]

$uid=mysql_real_escape_string( $_GET["uid"] );

this

$uid = mysql_escape_string(strip_tags(htmlspecialchars($_GET['uid']))); 

could be a lot better

[murshid7]

Where do i use d script

on core.php top

[paramound]

remove all forms of request password, or forgotten password to avoid the send me the password hacking method